Internet Explorer is getting major repairs, as Microsoft has issued 41 patches to fix memory vulnerabilities in its browser.
The Internet Explorer patches are part of the company’s routine monthly release of security and bug fixes for its software products, called “Patch Tuesday.” Microsoft Office and both the desktop and server editions of Windows are also getting fixes in this batch.
Overall, Microsoft issued patches to cover 56 different vulnerabilities, which are bundled into nine separate security bulletins.
Three of the bulletins are marked as critical, meaning they fix vulnerabilities that could be exploited by malicious attackers without user intervention. System administrators should tend to critical vulnerabilities as quickly as possible. These bulletins cover Internet Explorer and both the server and desktop editions of Windows.
All three collections of critical patches will require a reboot of the machine to take effect.
The patches in the Internet Explorer critical bulletin, which affects all versions of the browser, address the way the browser handles objects in memory. Microsoft has addressed the issue of memory vulnerabilities in its ASLR (address space layout randomization) technology. The patches add permissions validations to ensure Internet Explorer uses ASLR correctly.
Of the 41 Internet Explorer vulnerabilities, only one has been publicly disclosed, but it can only be used in conjunction with other vulnerabilities.
This approach is not unusual, said Wolfgang Kandek, chief technology officer for the Qualys IT security firm. These days, many attackers deploy “blended attacks” that use multiple vulnerabilities in conjunction with one another to compromise a system.
The remaining six bulletins are marked as important, which means they address vulnerabilities that could be exploited by attackers usually by requiring the unwitting participation of the user, such as by tricking him or her into clicking on a specially crafted Web page.
Organizations using Microsoft Office should inspect the bulletins issued this month that touch upon that software, Kandek said. One vulnerability, covered in MS15-012, allows an attacker to gain control of a system merely by tricking the user into opening a document, such as an email, with malicious code embedded inside.
One of the more unusual patches, MS15-011, covers a vulnerability in Windows group policy, which is configuration management technology that Kandek has never seen Microsoft patch before. It only affects larger enterprises that use domain controllers to manage fleets of Windows machines.
In the wrong hands, this vulnerability could be used to take control of large numbers of Windows machines within an organization, Kandek said. MS15-011 shows that Microsoft is digging deeper into its own code base to look for potential security weaknesses.
The group policy patch is not available for Windows 2003, which Microsoft will stop supporting in July.
Microsoft found that the fix would be “too disruptive” to apply to Windows 2003, Kandek said, especially given that the company will stop supporting this operating system shortly. It is a good reminder for those shops still running the nearly outdated OS to update soon.
In addition to releasing the patches, Microsoft did other security housecleaning Tuesday.
It has re-released a patch for Microsoft Excel. It has expanded its auditing capabilities in the newer versions of Windows. It has revised a security advisory on how to limit data leakage that could stem from the Security Sockets Layer version 3.0.
Usually Adobe also issues security patches on the first Tuesday of each month, alongside Microsoft. This month, the company has not done so, though it has already issued four critical patches since the beginning of the year. Administrators busying themselves with the Microsoft patches should make sure they are up to date with Adobe’s as well, Kandek said.
Updated at 3:42 PM with additional details.